rename command usage
Differences between SPL and SPL2
Renames must be comma-delimited
Each pair of rename fields must be separated by a comma. Otherwise a parsing error is returned.
| Version | Example |
|---|---|
| SPL | rename pid AS ProductID cid AS CustomerID |
| SPL2 | rename pid AS ProductID, cid AS CustomerID |
Certain renames are invalid
Renames of the same field is not allowed.
| Version | Example |
|---|---|
| SPL | ...rename A as B, A as C |
| SPL2 | Not supported |
Merging multiple fields is invalid
Attempting to merge multiple fields with a rename is not allowed.
| Version | Example |
|---|---|
| SPL | ... rename A as B, C as B |
| SPL2 | Not supported |
Chained or circular renaming is invalid
Using transitive renames that result in chained renaming or circular naming is not allowed.
| Version | Example 1 | Example 2 |
|---|---|---|
| SPL | ... rename A as B, B as C | ... rename A as B, C as A |
| SPL2 | Not supported | Not supported |
See also
Last modified on 20 October, 2020
| rename command syntax details | rename command examples |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!